8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43947

CVE-2026-43947: FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Summary

An unauthenticated Remote Code Execution vulnerability exists in FUXA when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: true is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions.

Script IDs and names can be obtained through the unauthenticated information disclosure in GET /api/project (reported separately).

The only prerequisite is that at least one server-side script exists in the project.

Details

Authorization confused deputy in script execution

File: server/runtime/scripts/index.js, lines 86-103

The authorization check looks up the stored script by ID and validates the stored script's permission field:

this.isAuthorised = function (_script, permission) {
    const st = scriptModule.getScript(_script);  // finds stored script by _script.id
    if (admin || (st && (!st.permission || st.permission & permission))) {
        return true;
    }
    return false;
}

When a script has no permission field set (or permission: 0), the expression !st.permission evaluates to true, and the check passes for any caller including guests.

Guest auto-authentication in the middleware

File: server/api/jwt-helper.js, lines 46-72

The verifyToken middleware generates a valid guest JWT when no token is provided:

if (!token) {
    token = getGuestToken();
}

The guest token passes verification. The request proceeds to the handler with . The check then finds the stored script and validates against its permission. Scripts without a field pass for any user including guests.

Miggo Vulnerability Database

→

CVE-2026-43947

CVE-2026-43947:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	= 1.3.0	1.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unauthenticated remote code execution in FUXA. It stems from a combination of flaws in the authorization mechanism for server-side scripts and the presence of a 'test mode' for script execution. An unauthenticated attacker can exploit this by sending a specially crafted request to the /api/runscript endpoint.

The vulnerability is triggered as follows:

The attacker sends a POST request to /api/runscript with test: true and malicious code in the code field. The request targets an existing script ID, which can be obtained via an information disclosure vulnerability.
The isAuthorised function in server/runtime/scripts/index.js is called to check if the user has permission to run the script. Due to a flaw in the logic, if the script has no permission property, the check passes for any user, including the default 'guest' user.
Alternatively, the isAuthorisedByScriptName function was flawed. Before the patch, if a non-existent script name was provided, it would return true, bypassing authorization.
Once authorized, the runTestScript function in server/runtime/scripts/msm.js is invoked. This function takes the attacker-supplied code from the request and executes it, leading to remote code execution on the server.

Vulnerable functions

ScriptsManager.isAuthorisedByScriptName

server/runtime/scripts/index.js

This function was vulnerable to an authorization bypass. Before the patch, if a script name provided did not exist, the function would return `true`, incorrectly authorizing the request. This allowed an attacker to bypass security checks and execute arbitrary code through the script testing functionality.

ScriptsManager.isAuthorised

server/runtime/scripts/index.js

This function contains a flawed authorization check. If a script exists but does not have the `permission` property set, the expression `!st.permission` evaluates to `true`, granting access to any user, including unauthenticated guests. This allows an attacker to use existing, unprotected scripts to trigger the code execution vulnerability.

runTestScript

server/runtime/scripts/msm.js

This function is the entry point for the remote code execution. When the `test` parameter is set to `true` in a request to `/api/runscript`, this function is called to execute the provided code. The vulnerability lies in the fact that the authorization check is performed on a stored script, but the code executed is supplied by the attacker in the request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-43947: FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Summary

Details

CVE-2026-43947:

8.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

8.9

8.9

CVE-2026-43947: FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Summary

Details

Basic Information

Basic Information

PoC

Impact

8.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-43947: FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Summary

Details

CVE-2026-43947:

8.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.9

8.9

CVE-2026-43947: FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Summary

Details

Basic Information

Basic Information

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI